I'm designing a RESTFUL API that will always be used over HTTPS, what security advantages over the use of HTTP Basic Auth could be brought to my system by using such kind of message authentication codes?

Example of HMAC could be this one of AWS.


HTTPS is HTTP-within-SSL and SSL already enforces integrity checks -- indeed, it does so with HMAC (see section 6.2.3).

Using Basic authentication is safe within SSL, and sufficient. You don't need an extra HMAC. The method shown by AWS is meant to provide some sort of authentication in situations where data travels unprotected, in order to prevent the client credentials from travelling as cleartext, because an eavesdropper could otherwise learn them; SSL provides both confidentiality and integrity, making this point moot.

  • The "not" should not be in "where the client credentials do not travel", correct? The HMAC is for when credentials do travel as cleartext. – user50849 Sep 5 '13 at 11:19
  • 1
    I have clarified the wording. – Tom Leek Sep 5 '13 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.